major fixes

apps/api/internal/httpapi/company_handlers.go

@@ -180,7 +180,13 @@ func (s *Server) handleListTeam(w http.ResponseWriter, r *http.Request) {
 		Email   string    `json:"email"`
 		Name    *string   `json:"name"`
 		IsOwner bool      `json:"is_owner"`
+		// Restricted / DeniedCount summarise the owner-set access overlay so the team
+		// table can badge restricted members without a request per row.
+		Restricted  bool `json:"restricted"`
+		DeniedCount int  `json:"denied_count"`
 	}
+	// Best effort: a missing permissions column (pre-migration) just means "no overlay".
+	overlays, _ := s.Auth.MemberPermissionsByCompany(r.Context(), cid)
 	out := make([]member, 0)
 	for rows.Next() {
 		var m member
@@ -189,6 +195,10 @@ func (s *Server) handleListTeam(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		m.IsOwner = ownerUserID != nil && *ownerUserID == m.UserID
+		if !m.IsOwner {
+			m.DeniedCount = len(deniedKeys(overlays[m.UserID]))
+			m.Restricted = m.DeniedCount > 0
+		}
 		out = append(out, m)
 	}
 	resp := map[string]any{"members": out, "total": total, "limit": limit, "offset": offset}